# Ensure secrets are not stored in plaintext in render.yaml or code

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876670529539-ensure-secrets-are-not-stored-in-plaintext-in-renderyaml-or-code
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure passwords, API keys, tokens, and connection strings are not written as literal values in render.yaml files or source code. In render.yaml, secrets should use sync: false (so the value is entered in the dashboard), fromDatabase, fromService, generateValue, or an environment group.

**Rationale**

Anything committed to a Git repository can be read by everyone with repository access, copied into forks, and stays in the Git history even after it is deleted. Secrets stored this way are easy to leak. Keeping them out of the repository, and setting them in Render instead, prevents this.

**Impact**

-   Secrets are not exposed through the Git repository
    
-   Secrets can be rotated without code changes
    
-   Leaked secrets must be rotated and removed from history
    

**Default Value**

Render does not block literal secret values in render.yaml.

**Pre-Requisites**

-   Access to the repositories that contain render.yaml and application code
    

**Remediation**

**Test Plan**

1.  Search each repository's render.yaml and source code for literal secrets, for example with a secret scanner such as gitleaks or trufflehog, or GitHub secret scanning.
    
2.  In render.yaml, check every envVars entry that holds a secret and confirm it uses sync: false, fromDatabase, fromService, generateValue, or an environment group instead of value:.
    
3.  If any literal secret is found, follow the implementation steps.
    

**Implementation Steps**

1.  Rotate the exposed secret with its provider first, because it must be treated as leaked.
    
2.  In render.yaml, replace the literal value: with sync: false (then enter the value in the Render Dashboard), or use fromDatabase, fromService, generateValue, or an environment group.
    
3.  Remove secrets from source code and read them from environment variables instead.
    
4.  Commit the change, and remove the secret from Git history if your policy requires it.
    

**Backout Plan**

1.  Revert the render.yaml change in Git if a deploy fails, and set the value in the Render Dashboard instead of committing it.
    

**Reference**

-   [https://render.com/docs/blueprint-spec](https://render.com/docs/blueprint-spec)
    
-   [https://render.com/docs/configure-environment-variables](https://render.com/docs/configure-environment-variables)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.